EAR classloading
by Angel Todorov
Hi All,
Our company is evaluating JBoss as an application server choice for
our current applications to be deployed on. I have two questions
regarding the structure of the EAR in JBOSS with respect to class
loading.
According to the J2EE 1.4 specification, one can put utility jars in
the EAR, which are visible to all wars and EJB modules that make up
the enterprise application. I am trying to do that with JBoss, but get
ClassNotFoundExceptions. If i put all jars in the WAR that needs them,
all classes are loaded properly.
My second question is regarding class loader isolation in the EAR
scope. Suppose I have some enterpise application and several webapps
in it. At some point they both require the same libraries (jars), but
one of the webapps wants to use a specific version of some jar only
for itself. If I have some X.jar as a utility jar visible to two WARs,
and WAR 1 has another version of X.jar in its own lib directory, which
classes will be loaded first when the respective class in the webapp 1
requests them - the ones in its own lib directory, or the shared ones?
Thank you very much for the feedback.
Best Regards,
Angel
19Â years, 2Â months
[JBoss Seam] - Re: Security Remember Me Functionality
by christian.bauerï¼ jboss.com
Furthermore: Today, clients can fill out login-forms automatically. It is a much safer approach:
a) the user decides when he wants to store sensitive information on the client (e.g. not on a browser in some internet cafe)
b) the user has a clear warning and a message (Do you want to store that login information?) that he has seen before, not some obscure Remember Me checkbox with an unknown implementation he can't control
c) the user can apply local measures to improve security, for example, my remembered login form data is stored in a master-password protected wallet (Safari + OS X)
d) its much harder for attackers to abuse this functionality for fishing, you'd need DNS spoofing to get the victim to a malicious webpage with a faked domain, so that the client auto-fills the attackers form
Having said that, we might add the "trusted client" Remember Me to Seam, but only with big red warning lights.
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4018118#4018118
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4018118
19Â years, 2Â months
[JBoss Seam] - Re: Security Remember Me Functionality
by christian.bauerï¼ jboss.com
>From a security perspective, this is not a good idea. I can steal your username and password from the cookie with a bit of Javascript. The only requirement for that is that somewhere in the web application, user input is printed on the webpage unfiltered (e.g. on a registration screen, there is an "The address $email is not valid." error message and $email comes form a form field.)
I make you click on a link I prepared and redirect you with a POST and some malicious payload to the vulnerable registration form. My POST enters Javascript code into the form that gets then printed onto the webpage in the error message. In that Javascript, I read your cookie and send it to my server.
This is known as cross-site scripting and there are many variations. Short story: Do not trust the client, do not store sensitive information on the client.
The best "Remember Me" feature is something similar to what Amazon is using: A username cookie is stored on the client, and the web application welcomes the user with his real name and also shows the remembered shopping basket. However, any sensitive operation (editing the shopping basket, buying stuff) requires re-authentication. This combined with an application audit for XSS holes is a good strategy.
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4018114#4018114
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4018114
19Â years, 2Â months
[JBossWS] - Re: Can not javax.xml.bind.JAXBContext in which jar file.
by rlamie
Thomas,
After checking out a fresh copy of the 1.2.0 branch, I tried to run the release target.
Several points :
1/ Ant.properties
# Optional JBoss Home
#jboss50.home=/home/tdiesler/svn/jbossas/trunk/build/output/jboss-5.0.0.Beta2
#jboss42.home=/home/tdiesler/svn/jbossas/branches/Branch_4_2/build/output/jboss-4.2.0.CR1-ejb3
#jboss40.home=/home/tdiesler/svn/jbossas/branches/Branch_4_0/build/output/jboss-4.0.5.SP1-ejb3
Actually not very optional, you have to define each jbossX.home, no way to define only 1 integration point.
2/ build-setup.xml
Obviously links to jbossX.thirdparty are rather personal :-)
After that, it's ok.
Just another big point, when i try , i got the following error :
Could not load provider:org.jboss.ws.tools.jaxws.impl.WSContractConsumerFactoryImpl
I searched the implementation class and found nothing in the source... missed something ?
Thank you.
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4018104#4018104
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4018104
19Â years, 2Â months